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(U) L Frances j, Flcisch, do herein stale and declare as fo Slows: 

1, (U) Introduction 

1 . (U) 1 am the Executive Director for the National Security Agency (NS A), an 

intelligence agency within the Department of Defense. 1 have held this position since June 2010. 
As the Executive Director. I serve as an adjunct to the Depuiy Director for all NSA matters. 

Under our internal regulations, and in the absence of the Director and Deputy Director. ! am 
responsible for directing the NSA. overseeing the operations undertaken to carry out ils mission 
and. by specific charge of the President and ihe Director of National Intelligence, protecting NSA 
activities and intelligence sources and methods. I have been designated an original TOP SECREV" 
classification authority under Executive Order No. 13526. 75 Fed, Reg. 707 (2009) and 
Department of Defense Directive No. 5200. 1 -R. Information and Security Program Regulation. 

32 C.F.R. § 159a. 12 (2000). 
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2. (U) The purpose ot'lhis declaration is to support an assertion of the military and 

state secrets privilege (hereafter, "state secrets privilege ") by the Director of National Intelligence 
(“DN[") as the head of the Intelligence Community, as well as the DNI's assertion of a statutory 
privilege under the National Security Act. to protect information related to NSA activities 
described herein below. General Keith B. Alexander, the Director of the National Security 
Agency, has been sued in his official and individual capacity n the above captioned litigation anc 
has recused himself from the decision on whether to assert privilege in his oH'ivia! capacity. As 
the Executive Director, and by specific delegation of the Director, I am authorized to review- the 
materials associated with this litigation, prepare whatever declarations I determine are 
appropriate, and determine whether to assert the NSA’s statutory pri\ilege. Through this 
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declaration. I hereby invoke and assert the NSA's statutory privilege set forth in Section 6 of the 
National Security Agency Act of 1959, Public Law No. 86-36 (codified as a note to 50 U.S.C. § 
402) ("NSA Act"), to protect the information related to NSA activities described herein below. 
The statements made herein are based on my personal knowledge of NSA activities and 
operations, and on information made available to me as the Executive Director of the NSA. 1 
U. (U) Summary 

3. (U) In the course of my official duties, 1 have been advised of the above-captioned 

Jewel, Shubert. and In re NSA Telecommunications Records Litigation, and 1 have reviewed the 
allegations raised in this litigation, including the Complaint filed in the Jewel action on Septembejr 
1 8, 2008, and the Second Amended Complaint ("SAC") filed in the above-referenced Shubert 
action on May 8. 20 12. 2 In sum. plaintiffs allege that, after the 9/1 1 attacks, the NSA received 
presidential authorization to engage in "dragnet" communications surveillance in concert with 
najor telecommunications companies. See. e g.. Jewel Comp!. HU 2-3; Shubert SAC HU 1 -7. 
Plaintiffs allege that the presidential I y-authorized activities at issue in this litigation went beyond 
he "Terrorist Surveillance Program’' ("TSP"), which was publicly acknowledged by the President 



1 (U) This declaration addresses and asserts privilege with respect to allegations raised in 
he above-captioned Jewel action as well as a separate action— Sh ubert v. Obama (07-cv-00693), 
n addition, the harm to national security that would result from the disclosure of NSA sources 
md methods described herein is applicable to similar allegations concerning NSA activities 
aised in other lawsuits in In re NSA Telecommunications Records Litigation (M:06-cv-1791 ) 

OC/N F ) Starting in 2006. the Director of National Intelligence, supported by 
leclarations from the NSA like this one, has asserted the state secrets privilege and related 
itatutory privileges concerning NSA intelligence sources and methods in several other cases that 
lave been before this court, including in a 2006 lawsuit brought by the plaintiffs in Jewel against 
\T&T (Hepting v. AT&T) (06-cv-00672), as well as in 2007 with respect to lawsuits brought 
igainst Verizon Communications, and again in 2007 and 2009 in the Shubert action, and also in 
!009 in the Jewel action. This declaration concerns the same sources and methods that were at 
ssue in those prior declarations, and sets forth substantially the same facts and harms to national 
;ecurity previously described to the court. In light of the passage of time, this submission 
ipdates. expands upon, and supplants prior privilege assertions in this litigation. 
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in December 2005 and was limited lo the interception o f spec i lie international communication^ 

involving persons reasonably believed lo he associated with al Qaeda and affiliated terrorist 
organizations. Rather, plaintiffs allege that other intelligence activities were also authorized by 
the President after 9/1 !. and that, with the assistance of telecommunication companies, including 
AT& l and Verizon, the NSA has indiscriminately intercepted the content and obtained the 
communications records of millions of ordinary Americans as part of an alleged presidenlinJIy- 
authorized ’'Program'' after 9/1 I, See Jewel Compl. rf 2-13; 39-97; Shubert SAC 1J1! I -7: 57-58: 
60-91. 

4. (U) 1 cannot disclose on the public record the sped lie nature of NSA information 
or activities implicated by the plaintiffs’ allegations. As described further below, the disclosure 
of information related to the NSA's activities, sources, and methods implicated by the plaintiffs' 
allegations reasonably could be expected to cause exceptionally grave damage to the national 
security of the United States. In addition, it is my judgment that sensitive state secrets are so 
centra! to the subject matter of the litigation that any attempt to proceed in the case risks 
disclosure of the classified privileged national security information described herein and 
exceptionally grave damage to the national security of the United States. 

5. The allegations in this lawsuit put at issue the 
disclosure of information concerning several highly classified and critically important NSA 
intelligence aetiv kies, sources and methods that commenced under presidential authorization 
after the 9/1 1 terrorist attacks, but which were later transitioned to the authority of" the Foreign 
Intelligence Surveillance Act (“FISA"), including ongoing activities conducted under orders 
approved by the Foreign Intelligence Surveillance Court ("FISC")/ As described in more detail 



pOC/NT) As described further below, pursuant to the FISA and 
specific orders of the FISC, the intelligence activities that NSA curries out under [lie authority of 
he FISA and authorization of the FISC are classified, NSA's FI SC -approved activities that are 
d issue here are classified at the TOP SECRET//COMINT level as their unauthorized disclosure 
'Lissificd in Camera. Lx Pane Declaration of Trances J Heisch. Nulinnul Security 
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below, starting in October 2001 , then- Pres iden^usrnssued a presidential authorization that 
directed the NSA to undertake three discrete activities after the 9/1 1 attacks that were designed 
to enhance NSA's capability to detect and prevent further attacks. (Collectively these activities 
were designated by the NSA code-name ''STELLARWfND^.) 

a. Baskej I_ - Contenj CoUectiorr . The first presidential ly- 

authorized activity after the 9/1 ] attacks was the collection of the content 4 of 
certain international communications (telephone and Internet) reasonably believed 
to involve a member of a terrorist organization. From the outset this activity was 
limited by the NSA to “one-end international” communications - that is, to or 
from the United States. This content collection activity was directed at groups 
engaged in international terrorism and, starting March 2004, was limited to 
international communications reasonably believed to involve an individual 
associated specifically with al Qaeda or its affiliated organizations. When 
publicly acknowledged in December 2005, this content collection activity was 
referred to as the "Terrorist Surveillance Program.” The TSP authorization ended 
in February 2007 and was initially replaced by orders of the FISC, which were 
later supplanted by Congressional amendments to the FISA that authorized the 
NSA to collect certain communications of non-U. S. persons located overseas. 

B. Baskej 2 - Telephony Mela Dgta \ The second 
activity undertaken by the NSA after the 9/1 1 attacks, pursuant to the same 
presidential authorization, entailed the bulk collection of telephony “meta data” — 
which is information derived from call detail records that refects, but is not 
limited to, the date, time, and duration of telephone calls, as well as the phone 
numbers used to place and receive the calls. As described below, this activity was 
transitioned to an order of the FISC starting in May 2006 and, while subject to 
subsequent modification by (he FISC, remains in place today. 

C. Basket 3 - Internet Mm The third 
activity undertaken by the NSA after the 9/1 1 attacks, again pursuant to the same 
presidential authorization, was the bulk collection of Internet meta data, which is 
header/rouler/addressing information, such as the “to.” “from,” “cc," and "bcc” 
lines on an email, as opposed to the content or subject lines of a standard email. 

As described below, this activity was transitioned to an order of the FISC starting 
in July 2004 until December 2011, when NSA decided not to seek reauthorizalion 
of this activity. 5 



could reasonably be expected to cause exceptionally grave damage to the national security of the 
United States. 

4 (T S//S I The term "content” is used herein to refer to the substance, meaning, 
or purport of a communication, as defined in 18 U.S.C. § 2510(8). as opposed to the type of 
addressing or routing information referred throughout this declaration as “meta data.” 

5 ffS//6I//OC/P I F) | 
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6. fTS/fTCWSWOCmF) Plaintiffs' allegations put at issue all three NSA activities 
originally authorized by the President after the 9/1 1 attacks and later transitioned to FISA 
authority. For example, plaintiffs in both the Jewel and Shuheri actions allege that the NSA was 
authorized by the President to engage in a communications ''dragnet" after 9/1 1 that included the 
indiscriminate collection of the content of’ mil lions of telephony and Internet communications. 
Sen Jewel Compl. ^ 7, 9, 73, 74, 81 ; Shubert SAC ^ 7, 70, 84. This allegation of a content 
"dragnet"' is false, however. The NSA's collection of the content of communications (u j ., the 
substance, meaning or purport of the communication) under the post 9/1 1 presidential 
authorization was directed at one-end international communications in which a participant was 
reasonably believed to be associated with a group engaged in international terrorism (later 
limited to al Qaeda and its affiliates), and was focused on specific "'selectors" (such as phone 
numbers and Internet addresses) believed to be associated with such individuals. The content 
surveillance authorized therefore did not constitute the kind of "dragnet" collection ofThe 
content of millions of Americans' telephone or Internet communications that the plaintiffs allege. 



NSA content collection activities could not be disclosed to address, disprove, or otherwise 
litigate the plaintiffs' allegation of a content "dragnet" without causing exceptional harm to 
NSA's sources and methods of gathering intelligence— including methods currently used to 
detect and prevent further terrorist airacks under the authority of the FISA, 



7. -f T6//TS I V/fi I jVOC/N F) Similarly, plaintiffs' allegations that the NSA has 
collected certain non-content information {/>., meta data) about telephone and Internet 
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communications cannot be addressed without risking or requiring disclosure of highly sensitive 

sources and methods that continue to be utilized today and causing exceptionally grave damage 
to national security. As explained below, the bulk collection of meta data enables highly 
sophisticated analytical tools that can the 

or agents 

8. Jn addition, plaintiffs' allegation that 

telecommunications carriers, including AT&T (at issue in Jewel) and Verizon (at issue in 
Shubert). and other carriers at issue in other lawsuits in In re NSA Telecommunications Record 
Litigation , assisted the NSA in alleged intelligence activities cannot be confirmed or denied 
without risking exceptionally grave damage to national security. Because the NSA has not 
undertaken the alleged "dragnet" collection of communications content, no carrier has assisted in 
hat alleged activity. I 
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below, the DNTs stale secrets and statutory pnvueg^ssortinns, and my own statutory privilege 
assertion on behalf of the NS A, seek to protect against the disclosure of the highly classified 
intelligence sources and methods put at issue in this case, including: ( l ) any information that 
would lend lo confirm or deny whether particular individuals, including the named plaintiffs, 
have been subject to the alleged NSA intelligence activities: (2) information concerning NSA 
intelligence sources and methods, including facts demonstrating that the content collection under 
the I SP wax limited to terrorist-related international communications, and that NSA did not and 
does not otherwise engage in plaintiffs' alleged content survcil lance “dragnet’': (3) facts that 
would tend to confirm or deny the other intelligence activities authorized by the President after 
9/1 1 and later transitioned to the authority of the FISA - that is. existence of theNSA's bulk 
ineta data collection, and any information about those activities: and (4) the tact ihat| 

In 




particular, the fact that there has been public speculation about alleged NSA activities, including 
in media reports, books, or plaintiffs' declarations, does not diminish the need to protect 
intelligence sources and methods from further exposure. 1 he process of sorting out what is true, 
tartly true, or wholly false in public reports or in plaintiffs' allegations and declarations, would 
iccessarily risk or require disclosure of what in fact the NSA has undertaken, when. how. and 
jnder what authority. As set forth herein, such official confirmation and disclosure of classified 
privileged national security information by the Government would remove any doubt as to 
EISA's actual sources and methods, confirm to our adversaries what channels of communication 
o a\nid. and cause exceptionally grave damage to the national security. For these reasons, as set 
onh further below. I request that the Court uphold the DNFs state secrets and statutory privilege 
insertions, as well as the NSA statu ton privilege assertion that 1 now’ raise, and protect the 
n format inn described in this declaration from disclosure. 
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III. (U) Classification of Declaration 
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12. ^S//6I//NF) This declaration is classified TOP SECRET//TSP//S 
J//ORCON/NOFORN pursuant to the standards in Executive Order No. 1 3526. See 75 Fed. 

Reg. 707 (Dec. 29, 2009). Under Executive Order No. 13526, information is classified iL TOP 
SECRET' 1 if unauthorized disclosure of the information reasonably could be expected to cause 
exceptionally grave damage to the national security of the United Sates; "SECRET' if 
unauthorized disclosure of the information reasonably could be expected to cause serious 
damage to national security: and "CONFIDENTIAL" if unauthorized disclosure of the 
information reasonably could be expected to cause identifiable damage to national security. At 
the beginning of each paragraph of this declaration, the letter or letters in parentheses 
designate(s) the degree of classification of the information the paragraph contains. When used 
for this purpose* the letters "U," "CY" "SY and "TS V indicate re spectively that the information is 
either UNCLASSIFIED, or is classified CONFIDENTIAL. SECRET, or TOP SECRET. 7 

13. (U//POU0) Additionally, this declaration also contains Sensitive Compartmented 
Information (SCI), which is "information that not only is classified for national security reasons 
as Top Secret, Secret, or Confidential, but also is subject to special access and handling 
requirements because it involves or derives from particularly sensitive intelligence sources and 
methods.” 28 C.F.R. § 1 7. 1 8(a). Because of the exceptional sensitivity and vulnerability of such 
information, these safeguards and access requirements exceed the access standards that are 
normally required for information of the same classification level. Specifically, this declaration 
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references communications intelligence (COMINT), also referred to as special intelligence (SI), 

which is a subcategory of SCI. COMINT or SI identifies SCI that was derived from exploiting 
cryptographic systems or other protected sources by applying methods or techniques, or from 
foreign communications, 

14, This declaration also contains information 

related to or derived from the STELLAR WIND program, a controlled access signals intelligence 
program under Presidential authorization created in response to the attacks of 9/1 1 . In this 



declaration, infonnation pertaining to the STELLARWfND program is denoted with the special 
marking ”TSP" and requires more restrictive handling. 8 Despite the December 2005 public 



acknowledgment of the TSP, details about the TSP program as well as the STELLAR WIND 



program in its entirety, remain highly classified and strictly compartmenled. 





s -ffO//TOP/O i^^^^P‘ee i KF} Information pertaining to the STELLARWIND 
program can also be denoted with the special marking "STLW.” In prior declarations and 
briefing materials. NSA has used the 'TSP” designation to refer to the portion of the 
that was publicly disclosed by ihen-President Bush in December 2005 J 
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1 5. (U) In addition to the fact that classified info mi at ion contained herein may not be 

revealed to any person without authorization pursuant to Executive Order 13526. this declaration 

contains information that may not be released to foreign governments, foreign nationals, or non- 

LFS. citizens without permission of the originator and in accordance with DNI policy. This 

information is labeled "NOFORNT The vi ORCON" designator means that the originator of the 

information controls to whom it is released. 

IV, (U) Background Information 

A- (U) The National Security Agency 

16. (U)The NSA was established by Presidential Directive in 1952 as a separately 
organized agency within the Department of Defense. The NSA's foreign intelligence mission 
includes the responsibility to collect, process, analyze, pioduce, and disseminate signals 
intelligence (SlGfNT) information, of which communications intelligence (''COMINT") is a 
significant subset, for (a) national foreign intelligence purposes, (b) counterintelligence purposes, 
and (c) the support of military operations. See Executive Order 12333, § 1.7(c), as amended. 

1 7. fTW/GIjWF) gjg na [ s intelligence (SlGfNT) consists of three subcategories: 

(1) communications intelligence (COMfNT): (2) electronic intelligence (ELINT): and (3) foreign 
instrumentation signals intelligence (F1S1NT). Communications intelligence (COMINT) is 
defined as '■‘all procedures and methods used in the interception of communications and the 



>0 




10 (IJ) Executive Order 12333, reprinted as amended in 50 U.S.C § 401 note, generally 
describes the NSA's authority to collect foreign intelligence that is not subject to the FISA 
definition of electronic surveillance, including activities undertaken abroad. Section 1 .7(c) of 
E.O. 1 2333, as amended, specifically authorizes the NSA to "'Collect (including through 
clandestine means), process, analyze, produce, and disseminate signals intelligence information 
for foreign intelligence and counterintelligence purposes to support national and departmental 
missions/' 
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obtaining of information from such communications by other than the intended recipients." 1 8 

U.S.C. § 798. COMFNT includes information derived from the interception of foreign and 

international communications, such as voice, facsimile, and computer-to-compuler information 

conveyed via a number of means 

I Electronic intelligence (ELrNT) is technical intelligence information derived from 

foreign non-communications electromagnetic radiations except atomic detonation or radioactive 

sources-— in essence, radar systems affiliated with military weapons platforms (e.g., anti-ship) 

and civilian systems (e.g., shipboard and air traffic control radars). Foreign instrumentation 

signals intelligence (FISfNT) is derived from the intercept of foreign electromagnetic emissions 

associated with the testing and operational deployment of non-U. S. aerospace, surface, and 

subsurface systems. 

18. (li) The NSA's SIGfNT responsibilities include establishing and operating an 
effective unified organization to conduct SIGfNT activities set forth in Executive Order No. 
12333, § 1.7(c)(2). as amended. In performing its SIGfNT mission, NSA has developed a 
sophisticated worldwide SJGINT collection network that acquires, among other things, foreign 
and international electronic communications and related information. The technological 
infrastructure that supports the NSA's foreign intelligence information collection network has 
taken years to develop at a cost of billions of dollars and untold human effort. It relies on 
sophisticated collection and processing technology. 

19. (U) Tiie re are two primary reasons for gathering and analyzing foreign 
intelligence information. The first, and most important, is to gain information required to direct 
US. resources as necessary to counter external threats and in support of military operations. The 
second reason is to obtain information necessary to the formulation of U.S. foreign policy. 
Foreign intelligence information provided by the NSA is thus relevant to a wide range of 
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important issues, including inilitar\ order of battle: threat warnings and readiness: arms 

proliferation: international terrorism: counter-intelligence: and foreign aspects ol international 

narcotics trafficking. 

20. (U) The NSA's ability to produce foreign intelligence information depends on its 
access to foreign and international electronic communications. Foreign intelligence produced by 
COMIN f activities is an extremely important part of the overall foreign intelligence information 
available to the 1 inited States and is often unobtainable by other means. Public disclosure of 
either the capability to collect specific communications or the substance of the information 
derived from such collection itself can easily alert targets to the vulnerability of their 
communications. Disclosure of even a single communication holds the potential of revealing 
intelligence collection techniques that are applied against targets around the world. Once alerted, 
targets can frustrate COMfNT collection by using different or new encryption techniques, by 
disseminating disinformation, or by utilizing a different communications link. Such evasion 
techniques may inhibit access to the target's communications and therefore deny the United 
States access to information crucial to the defense of the United States both at home and abroad. 
COMtNT is provided special statutory protection under 18 U.S.C. § 798. which makes it a crime 
to knowingly disclose to an unauthorized person classified information "concerning the 
communication intelligence activities of the United States or any foreign government.'' 

B. (U) September 1 1, 2001 and the al Qaeda Threat 

21. (U) On September 1 1 , 200 1 . the al Qaeda terrorist network launched a set of 
coordinated attacks along the East Coast of the United States. Four commercial jetliners, each 
carefully selected to be fully loaded with fuel for a transcontinental Eight, were hijacked by a! 
Qaeda operatives. Those operatives targeted the Nation's financial center in New York with two 
of the jetliners, which they deliberately flew into the Twin Towers of the World i rude Center. 
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A I Qaeda targeted the headquarters of the Nation's Armed I orccs. the Pentagon, with die third 

jetliner. Al Qaeda operands were apparently headed toward Washington, D.C. with the fourth 

jetliner when passengers struggled with the hijackers and the plane crashed in Shanksville, 

Pennsylvania. The intended target of this fourth jetliner was most evidently the While House or 

the Capitol, strongly suggesting that al Qaeda’s intended mission was to strike a decapitation 

blow' to the Government of the United States — to kill the President* the Vice President, or 

Members of Congress. The attacks of September 1 I resulted in approximately 3,000 deaths — 

the highest single-day death toll from hostile foreign attacks in the Nation’s history. In addition. 

these attacks shut dowm air travel in the United Slates, disrupted the Nation's financial markets 

and government operations* and caused billions of dollars of damage to the economy. 

22. (U) On September 14, 2001. a national emergency was declared “by reason of the 

terrorist attacks at the World I fade Center* New York. New York, and the Pentagon, and the 
continuing and immediate threat of further attacks on the 1 Tilled States." Presidential 
Proclamation No. 7463* 66 Fed. Reg. 48199 (Sept. !4. 2001 }. The United States also 
immediately began plans for a military response directed at al Qaeda's training grounds and 
havens in Afghanistan. On September 14, 2001, both Houses of Congress passed a Joint 
Resolution authorizing rhe President of (he United States “to use all necessary and appropriate 
force against those nations, organizations, or persons he determines planned, authorized, 
committed, or aided the terrorist attacks" of September 1 1 . Authorization for Use of Military 
Force, Pub. L No. 107-40 >> 21(a). 1 15 Slat. 224. 224 (Sept. 18. 2001) ("Cong, AuihT), 

Congress also expressly acknowledged that the attacks rendered it "necessary and appropriate" 
for the United States to exercise its right "to protect United States citizens both at home and 
abroad," and acknowledged in particular that "the President has authority under the Constitution 
to take action to deter and prevent acts of international terrorism against the United States. " hi. 
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23, (U) As a result of the unprecedented attacks of September 1 1, 2001, the United 
States found itself immediately propelled into a conflict with al Qaeda and its associated forces, a 
set of groups that possesses the evolving capability and intention of inflicting further attacks on 
the United States. That conflict is continuing today, at home as well as abroad. Moreover, the 
conflict against al Qaeda and its allies is a very different kind of conflict, against a very different 
enemy, than any other conflict or enemy the Nation has previously faced. Al Qaeda and its 
affiliates operate not as a traditional nation-state but as a diffuse, decentralized network of 
individuals, cells, and loosely associated, often disparate groups, that act sometimes in concert, 
sometimes independently, and sometimes in the United States, but always in secret — and their 
mission is to destroy lives and to disrupt a way of life through terrorist acts. Al Qaeda works in 
the shadows: secrecy is essential to al Qaeda's success in plotting and executing its terrorist 
attacks. 

24. (T0//0I//NF) The 9/t 1 attacks posed significant challenges for the NSA's signals 
intelligence mission because ol J 

I Global telecommunications networks, especially the Internet, have 



1 1 (U) Following the 9/1 1 attacks, the United States also immediately began plans for a 
military response directed at al Qaeda's training grounds and havens in Afghanistan. A Military 
Order was issued stating that the attacks of September 1 1 "created a state of armed conflict.' 7 see 
Military Order by the President § 1(a). 66 Fed. Reg. 57833. 57833 (Nov. 13, 2001). and that al 
Qaeda terrorists "possess both the capability and the intention to undertake further terrorist 
attacks against the United States that, if not detected and prevented, will cause mass deaths, mass 
injuries, and massive destruction of property, and may place at risk the continuity of the 
operations of the United States Government," and concluding that “an extraordinary emergency 
exists for national defense purposes." Military Order. § I (c). (g). 66 Fed. Reg. at 57833-34. 
Indeed, shortly after the attacks, NATO took the unprecedented step of invoking article 5 of the 
North Atlantic Treaty, which provides that an "armed attack against one or more of [the parties] 
shall be considered an attack against them all." North Atlantic Treaty, Apr. 4, 1 949, art. 5, 63 
Stat. 2241. 2244, 34 U.N.T.S. 243, 246. 
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developed in recent years into a loosely interconnected system — a network of networks— that is 

ideally suited for the secret communications needs of loosely affiliated terrorist cells. Hundreds 
of Internet service providers, or "ISPs/' and other providers of communications services offer a 

wide variety' of global communications options, often free of charge. I 
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26. (TG//S1//NF) Our efforts against al Qaeda and its affiliates therefore present 



critical challenges for the Naiion's communications intelligence capabilities. First, in this type 
ofconllici, more so than in any other we have ever faced, communications intelligence is 
essential to our ability to identify the enemy and to detect and disrupt its plans for further attacks 
on the United States. Communications intelligence often is the only means we have to learn the 
identities of particular individuals who are involved in terrorist activities and the existence of 
particular terrorist threats. Second, at the same time that communications intelligence is more 
important than ever, the decentralized, non-hierarchica) nature of the enemy and their 
sophistication in exploiting the agility of modem telecommunications make successful 
communications intelligence more difficult than ever. It is against this backdrop that the risks 
presented by this litigation should be assessed, in particular the risks of disclosing NS A sources 
and methods implicated by the claims being raised. 

C 1TS//TBP//QI//OC/NF1 FresidentiaHv-Authorizcd NSA Activities After 9/1 1 

27, (TS//TSP//SI//OC/NF) As indicated above, in December 2005 then-President 
Bush acknowledged the existence of a presidentially-authorized NSA activity called the 
^Terrorist Surveillance Program" under which NSA was authorized to intercept the content of 
specific international communications involving persons reasonably believed to be associated 
with al Qaeda and affiliated terrorist organizations. As also noted, other intelligence activities 
were authorized by the President after the 9/1 1 attacks in a single authorization and were 
subsequently authorized under orders issued by the Foreign intelligence Surveillance Court 
('"FISC"). As described below, disclosure of the intelligence sources and methods involved in 
the TSP and other classified activities reasonably can be expected to cause exceptionally grave 
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damage to national security. 

28, ^ TS//TOP//SI//OC/Nr) In the extraordinary circumstances after the 9/1 I attacks 
—when the Intelligetice Community believed further catastrophic attacks may be imminent— 
the President directed the NSA to address important gaps in its intelligence collection activities, 
and to undertake further measures to detect and prevent future attacks. Starling in October 2001 
and continuing with modifications, the President authorized NSA to undertake three activities. 12 
While these activities were distinct in nature, they were designed to work in tandem to meet the 
threat of another mass casualty terrorist attack by enabling NSA to not only intercept the content 
of particular terrorist communications, but to identify other phone numbers and email addresses 
with which a terrorist had been in contact - and thus, potentially, to identity other individuals 
who may be involved in plotting terrorist attacks/ 2 

1. fTG/yTOPtfCl//OC/Nn Basket 1 - Telephony and Email Content Collection 

29. (TS//TSP//S i//OeWF) First, the NSA was authorized by the President to 
intercept the content 14 of certain telephone and Internet communications for which there were 
reasonable grounds to believe that such communications originated or terminated outside the 

United States.B 



11 (TSff SfeVC CfTFF) In other lawsuits in In re NSA Telecommunications Records 
Litigation . some plaintiffs allege that NSA commenced the particular presideniially-auihorized 
intelligence activities put at issue in the allegations prior to the 9/1 1 attacks. The activities 
described herein were authorized by the President after the 9/1 1 attacks. 

Each Presidential authorization (with the exception of the first such 
authorization) was supported by a threat assessment memorandum signed by the Director of 
Central Intelligence until 2005 and thereafter by the Director of National Intelligence, which 
documented the current threat to the U.S. homeland and to U.S. interests abroad from al Qaeda 
and affiliated terrorist organizations. The DN1 has separately asserted privilege i.n order to 
prevent the disclosure of classified al Qaeda threat information. 

14 (T9//S F 1 ) Again, the term "content'' is used herein to refer to the substance, 
meaning, or purport of a communication, as defined in 18 U.S.C. § 2510(8). as distinguished 
from the type of addressing or routing information referred throughout this declaration as “meta 
data." 
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I Thus, the initial scope of the authorization permitted NSA to intercept 
communications where a communicant was not only reasonably believed to be a member or 
agent of al Qaeda and affiliated organizations, but of other international terrorist organizations as 

Starting in March 2004, the presidential 

content collection was limited to the collection of international communications where a party to 
such communication was reasonably believed to be a member or agent of al Qaeda or an 
affiliated terrorist organization. The existence of this activity was disclosed by Ihen-President 
Bush in December 2005 and subsequently referred to as the ''Terrorist Surveillance Program" 
("TSP"). The first presidential authorization of the TSP was on October 4, 2001 , and the TSP 
was reauthorized approximately every 30-60 days throughout the existence of the program * {y 

30. I I h Mil > Under the TSP, NSA collected the content of 

international telephone communications, B 



15 (TS//TSP//B1WOC/N F) The specific wording of the presidential authorizations 
evolved over time and during certain periods authorized other activities (this declaration is not 
intended to and does not fully describe the authorizations and the differences in those 
authorizations over time). For example, as already noted, the documents authonzin^h^^P 
also contained the authorizations for the mela data activities described hereinB 
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3 ! . (TG//TSP//BI//OONF) Authorization of the TSP was intended to address an 
important gap in NSA's intelligence collection activities---namely, that significant changes in 
communications technology since the enactment of the Foreign Intelligence Surveillance Act in 
1 978 meant that NS A faced great difficulties in identifying foreign terrorist operatives who were 
communicating with individuals within the United States. FISA established the framework for 
court approval of the U.S. Government's efforts to conduct foreign intelligence surveillance of 
individuals in the United States. When FISA was enacted in 1978, most international 
communications to or from the United States were transmitted via satellite or radio technology. 
Congress intentionally excluded the vast majority of satellite or radio communications from the 
definition of "electronic sinveillanee' 1 ' in the FISA. See 50 U.S.C. §1801(0- The interception of 
domestic communications within the United States, which were carried nearly exclusively on a 
wire, for foreign intelligence purposes, generally required a court order. As a result,B 



Bthe FISA did limit NSA's ability to collect “one-end” telephone or Internet 
international communications fo or from the United States on a wire inside the United States. 
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32. tTG/^TGP//fiI//OCW['') Since the lime FISA was enacted sweeping advances in 
modem telecommunications technology upset the balance struck by Congress in 1978. By 2001 , 
most international communications to or from the United Stales were on a wire and many 
domestic communications had increasingly become wireless. As a result of this change in 
communications technology, the NSA's collection from inside the United States of international 
communications (previously carried primarily via radio transmission) had shrunk considerably 
and the Government was forced to prepare FISA applications if it wished to collect the 
communications of non-U. S. persons located overseas. These circumstances presented a 
significant concern in the exceptional circumstances after 9/11. The NS A confronted the urgent 
need to identify further plots to attack U,S. interests both domestically and abroad. To do so. it 
needed to intercept the communications of terrorist operatives who, as described above® 




the United States was faced with the prospect of 



losing vital intelligence— and failing to detect another feared imminent attack— while the 
Government prepared individual applications for FISA Court authorization on a 
large number of rapidly changing selectors. 17 

33. (TG/j r TSP//Sl//OCfflF) Accordingly, after the 9/1 1 attacks, the President directed 
the NSA immediately to correct the gap in collecting the content of international 
communications from known or suspected foreign terrorists to or from (he United States, As 
described below, Congress subsequently agreed to certain amendments to the FISA to address 
this collection gap and gram NSA flexibility to collect quickJy on overseas, non-U. S, person 
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targets without individual RSC orders. Thus, sources and methods by which t he NSA 
intercepted the content of information undo' the TSP are still utilized toda\ under similar FISA 
authority and remain highly sensitive and classified information concerning the means by which 
the NSA may obtain significant foreign intelligence information, including, but not limited, to 
terrorist threats. 

2. (TS>yT9Py/9l//OC/W) Basket 2 - Bulk Telephony Meta Data Collection 

34. The second discrete NSA activity authorized 

by the President, again pursuant to the same presidential authorization, was the bulk collection of 
ineta data related to telephony communications. As noted, telephony meta data is information 
derived from call detail records that reflect non-content information such as. but not limited to. 
the date. time, and duration of telephone calls, as well as the phone numbers used to place and 
receive the calls. 18 The purpose of collecting telephony meta data in bulk is to query this 
information with particular “selectors'' (i.e. phone numbers) reasonably believed to be associated 
with a member or agent of al Qaeda or affiliated terrorist organization in order to ascertain other 
contacts and panems of communications for that selector. Thus, while the amount of telephony 
meta data obtained through the bulk collection under presidential authorization was significant. 
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only a tiny fraction of telephony mela data records collected by the NSA has actually been 



presented to a trained professional for analysis. 19 However, the collection of meta data in bulk is 
necessary to utilize sophisticated and vital analytical tools for tracking the contact 

of al Qaeda and its affiliates. Again, the particular sources and methods 
by which the NSA collects and analyzes telephony meta data remain in use today pursuant to 
authority of the FISA and Executive Order 12333, and constitute highly significant tools for 
detecting and preventing terrorist attacks and thus for protecting national security. 

3. (T3//T3P//9I//OC/NF) Basket 3 - Bulk Internet Meta Data Collection 

35, (TG/jTB f The third discrete NSA activity authorized 
by the President, again pursuant to the same presidential authorization, was the NSA collected 
bulk mela data related to Internet communications— header/router addressing information, such 
as the “to/' “from/ 1 “cc/ 1 and “bcc" lines, as opposed to the content or subject lines, of a 
standard email, 20 In addilion to collecting the content of particular communications] 




l NSA also obtained in bulk Internet meta data 

131 As with telephony meta 



19 f FO//TSP//6iy/OCj^F) NSA estimates that by the end of 2006, on!y^^^]of the 
telephony meta data collected had actually been retrieved for analysis. 
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data. NSA would then query the bulk Internet meta data with particular “selectors" (e,g. email 

address) reasonably believed to be associated with a member or agent of al Qaeda or affiliated 

lof Internet communications 



terrorist organization in order to ascertain other comactsj 
for that selector (and thus, again, only a tiny fraction oflnternel meta data collected was viewed 

by an analyst). I 
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D- 1T5//5I//OC/NF 1 ) Current NSA Activities Transitioned from Presidential 
Authority 

37. (TCV/TSP//GI//OC/NF) The three sources and methods of intelligence collection 
initially authorized by the President immediately following 9/ 1 l have evolved over the last 
eleven years and continue to be utilized today. Thus, disclosure of the particular sources and 
methods described herein as they were utilized under presidential authorization would 
compromise the use of those sources and methods under other authority and thereby risk 
exceptionally grave damage to national security. 

1. (T8//3I//OC/NF) Collection of Communication Content 

38, £TS//TS P//G I//OC/N F) First, in January of 2007 ? the content interception 
activities that had been occurring under the TSP were transitioned to authority of the FISA. 22 
Specifically, on January 10. 2007, the FISC issued orders authorizing the Government to conduct 
certain electronic surveillance that had been occurring under the TSP, Those orders included:! 



■the "‘Foreign Telephone and 

Email Order/' which authorized electronic surveillance of telephone and Internet 

co m muni cat ions where the Government determined that there 

was probable cause to believe that (i) one of the communicants is a member or agent ofm 



22 This declaration generally describes the transition of all three 

Presidentially-authorized activities to FISA authority, but does not describe in detail the FISC 
Orders themselves, the details of their periodic renewal, specific legal issues that arose, the 
process involved in obtaining FISC approval, continual briefings to the various congressional 
oversight committees, or any subsequent compliance issues and corrective action taken as a 
result of those incidents. The FISC undertakes close oversight of NSA activities that are subject 
to the FISA, and NSA has worked extensively to ensure compliance with FISC orders, including 
those described herein. 
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and (ii) the com muni c alio n is to or from a foreign country 
(/.e., a one-end foreign communication to or from the United States). Thereafter, any electronic 
surveillance, as that term is defined in the FISA (see 50 U,S.C. § 1801(f)), that was occurring as 
part of the TSP became subject to the approval of the FISA Court and the TSP was not 
reauthorized. 23 



39. ■ (TS//Sl//OC/WF) l 




23 (U) On January 17. 2007, the Attorney General made public the general facts that new 
orders of the Foreign Intelligence Surveillance Court had been issued that authorized the 
Government to target for collection international communications into or out of the United States 
where there is probable cause to believe that one of the communicants is a member or agent of al 
Qaeda or an associated terrorist organization; that, as a result of these orders, any electronic 
surveillance that had been occurring as part of the TSP was then being conducted subject to the 
approval of the FISA Court; and that, under these circumstances, the TSP was not reauthorized. 



24 



^ tfotfoi/zocmr 

FISC Foreign Tele phone and Email Order authorized NSA to intercept the conten t of 
communications of 



the January 2007 
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40, f TS//Siy/OC/N4 ? ) The process of seeking renewal of the January 2007 FISC 
Foreign Telephone and Email Order after its original 90 day authorization ultimately led the 
Executive Branch to press for and Congress to enact amendments to the FISA that granted NSA 
greater flexibility to collect the content of international communications without the need for 
individual FISC orders for each selector targeted. | 
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discussed next, this prompted NSA to 
seek additional statutory authority under the FISA to intercept the content of international 
communicaiions^^^^^^^^^^^^^mside the United States. 

4] . 1 (TS//TSP^Sl//OCj f NF ^ In August 2007, Congress enacted the Protect America 

Act ("PAA"), which granted NSA additional flexibility under the FISA to target international 
communications without an individual court order for each selector. Under the PAA, the FISA's 
definition of "electronic surveillance" was clarified to exclude “surveillance directed at a person 
reasonably believed to be located outside the United States" 50 U.S,C\ § 18G5A, This change in 
the definition of electronic surveillance under the FISA permitted the NSA to intercept 
communications off of a wire inside the United States without an individual court order so long 
as the target was located outside the United States. This restored some of the operational 
flexibility needed to swiftly target rapidly changing selectors on multiple terrorist targets that 
existed under the TSP. The PAA eliminated the need for the Foreign Telephone and Email 
Order, and that Order expired after the PAA was enacted. 

42, if f S//6 1//OC/N F j The PAA authorized the DNI and the Attorney General to 

jointly "authorize the acquisition of foreign intelligence information concerning persons 
reasonably believed to be outside the United Stales" for up to one year, id. $ 18056(a), and to 
issue directives to communications service providers requiring them to "immediately provide the 
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Govemjnent with all information, facilities, and assistance necessary to accomplish the 

acquisition" of necessary intelligence information, id. § 18053(e). Such directives were issued 
to a number of telecommunication and internet service providers,^ 
and the NS A conducted content surveillance of overseas targets under the PA A with the 
assistance of those telecommunication carriers. More specifically, in August 2007, the Attorney 
General and DN1 issued the requisite certifications, and, among other things, content collection 
under the PA A continued as to persons reasonably believed to be outside the United States 
involving communications of| 

Under the PAA, approximately^^! foreign 
selectors that had been authorized under the Foreign Telephone and Email Order were 
transitioned to collection by NSA under authority of the PAA, 

43. XTQ/j f 0I//O C7N V) The PAA was enacted as a temporary me isure set to expire in 
180 days, and it ultimately did expire on February 16. 2008 (although diret tives issued under the 
PAA continued in effect until their slated expiration dates). On July 1 1 . 2008, the Foreign 
Intelligence Surveillance Act Amendments Act of 2008 (FAA) was signed into law. Section 702 
of the FAA created new statutory authority and procedures that permitted the targeting of non- 
LJnited States persons reasonably believe to be outside of the United States without individual 
FISC orders but subject to directives issued to telecommunications earners by the Director of 
National Intelligence and the Attorney General under Section 702(h) of the FISA for the 
continuation of overseas surveillance under this new authority. See 50 U.S.C. § ISSla(h) (as 
added by the FISA Act of 2008, P.L 1 10-261). Directives that had been issued under the PAA 
for content surveil lance of overseas targets (including surveillance of specific^^^^! targets 
overseas) were thus replaced by new directives for such surveillance issued pursuant to the FAA. 
While the existence of prior PAA authority and current FAA authority are set forth in public 
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statutory provisions, the operational details of the sources and methods used by NS A to carry out 
that aulhoriu remain highly classified. 

44. ij f S//T S P//S I ffOC/N F ) As with the TSP. die purpose of the new authority in 

Section 702 of the FAA was to account for changes in communications technology since 1078 
whereby international communications were increasingly transmitted to the United States via 
fiber optic cable and, consequently, increasingly subject to FISA's definition of electronic 
surveillance and requirements. B> granting NSA the authorii) to conduct acquisitions inside the 
United Slates by targeting non-Uniled States persons located outside die United States in order to 
acquire foreign intelligence information without the need for individualized FISC orders 
approving surveillance for each individual target, Section 702 permitted the NSA to continue to 
undertake content surveillance for overseas targets in a manner similar to that permitted under 
the TSP. As of August 2012, NSA presently has a total of approximately individual 

foreign selectors under coverage pursuant to Section 702 of the FAA. Section 702 has proven to 
be a critical tool in the Government's efforts to acquire significant foreign intelligence necessary 
to protect the Nation's security and has quickly become one of the most important legal 
authorities available to the Intelligence Community, 

45, (TS//TS I W8l//OC/NF^ In sum, the post 9/1 1 content surveillance activities 
undertaken by the NSA evolved from the presidential ly authorized TSP to the FISC Foreign 
Telephone and Email Order, to the direeti\es issued under the PA A and, ultimately, to the 
directives that are now being issued puisuuiil to the FISA Amendments Act of 2008. Each 
authorization sought to enable the NSA to undertake content surveil lance on numerous multiple 
targets overseas without the need to obtain advance court approval for each target. But, as 
explained further below, none of these content surveillance activities has entailed the kind of 
indiscriminate "dragnet" content surveillance of domestic or international telephony or Internet 
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communications thal the plaintiffs allege* Rather, from the outset, content collection by the NSA 
has focused on international communications reasonably believed to invoke terrorist 
organ i zan 

2. (T S //S I //OC/NF) Collection of Bulk Telephony Meta data (Business Records) 

46. As set forth above, the second activity 
authorized by then- President Bush after ihe 9/1 I attacks was the bulk collection of meta data 
related to telephony communications — again, information derived from call detail records that 
reflect non-content information such as, but not limited to, the date, lime and duration of 
telephone calls, as well as the phone numbers used to place and received the calls. That activity, 
which began pursuant to Presidential authorization in October 2001 . continues today under the 
authority of the FISA. 

47. (T StfTSP//S l/ZQCAff j " Beginning in May 2006. the bulk collection of non- 
cornent telephony meta data, previously subject to Presidential authorization, was authorized by 
the FISC pursuant to what is known as the Telephone Business Records Order. The FISC found 
that, in order to protect against international terrorism, reasonable grounds existed to order 
certain telecommunication carriers to produce to the NSA in bulk "call detail records^ or 
"telephony meta data/' pursuant to 50 U,S,C, §1861 (c) (authorizing the production of business 
records for, inter alia, an investigation to protect against international terrorism). While this bulk 
collection is again very broad in scope, the NSA has been authorized by the FISC to query the 
archived telephony data solely with identified telephone numbers for which there are facts giving 
rise to a reasonable, articulable suspicion that that the number is associated with (among other 

targets (referred a 
determination). Bulk telephony meta data collection, as continued to be authorized under FISA 
authority, remains a vital source and method needed to utilize sophisticated analytical tools for 
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3. ffC//SI//OC/Nr) Collection of Bulk Internet Meta data 
48. (TS//TfiP//8 l //OCj^ i F) As also described above, the third activity authorized by 
then-President Bush alter the 9/1 1 attacks was the bulk collection of meta data related to internet 
communications. NSA carried out this bulk collection activity under presidential authorization 
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I During the period from^^^^^^^^2004. an 

application was prepared and submitted to the FISC to continue the bulk collection of Internet 
meta data, [n July 2004, the FISC authorized the bulk collection of Internet meta data through 
the use of a pen register and trap and trace device ("FISC Pen Register Order ' or "PRTT 
Order"). See 50 U.S.C. § 1841 ,ei seq. (defining "pen register'" and "trap and trace device"). 

49. ft S//0 1//0 C7N F) Initially, under the PRTT Order, NSA was authorized to 

collect, in bulk, meta data associated with electronic communication: 

in a manner similar to that which NSA had utilized under presidential 



authorization. Specifically, the collection of Internet meta data| 

authorized becauseB 



had been 



In addition, while NSA was authorized to collect 
B it was permitted to query the archived meta data 
only using Internet selectors for which there were facts giving rise to a reasonable, articulable 
suspicion that the email address was associated with| 

m As with bulk collection of telephony meta data 

collection, the bulk collection of Internet meta data allowed the NSA to use critical and unique 
analytical capabilities to track the contacts (even retrospectively]^^^^^^^^^^^^^^^|of 



Internet meta data in bulk 
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